Not able to create SQL LOGIN even though same does not exist in the server
Today I got request from one user that she is
trying to access the data source (SQL server) from EXCEL and not able to
connect. She was using her windows AD account to connect to the source.
She asked me to provide the required
permissions and I found she is not added in SQL login list. It is very simple,
just create login and map with required databases and that’s it. But this did
not work as expected and below is what I observed and experienced.
When try to create new login in required SQL
server, I got following error with error number 15025.
“The
server principal ‘<AD Account>’ already exists – MSG 15025”
But when I see list of logins, this login is
not present at all in the server. Immediately realized of possibilities that
this user AD account has been changed recently and previously she was having access
to the server with different AD account.
How I verified:
Execute the query below to see if the SID
already exists for this AD account.
select suser_sid ('<AD Account>')
I was surprised after seeing associated SID
for this account. So I executed below query to check the actual account for
which this SID was associated.
select * from sys.server_principals where SID = <SID_without_quotes>
I got the actual account name and this was
exactly her old AD account. Basically login already exists on the SQL server
with the same SID of the new login which I was trying to create.
I contacted user and inform that we need to
drop your old account in SQL login and create the new one and then only we will
be able to provide you the requested permissions. After getting confirmation, I
dropped the login and created new one with updated AD account name and then
user was able to access the data source without any issues.
Just wanted to share the experience so that all
my friends can understand this.
Hope this helps to all of my friends.